



















@@ -17,7 +17,7 @@ import {
1717type PackageManifest,
1818type PluginPackageChannel,
1919} from "./manifest.js";
20-import { isPathInsideWithRealpath, safeRealpathSync } from "./path-safety.js";
20+import { isPathInside, safeRealpathSync } from "./path-safety.js";
2121import { tracePluginLifecyclePhase } from "./plugin-lifecycle-trace.js";
2222import {
2323normalizePluginDependencySpecs,
@@ -33,18 +33,22 @@ function isRelativePathInsideOrEqual(relativePath: string): boolean {
3333);
3434}
353536-function resolvePackageJsonPath(record: InstalledPluginIndexRecord): string | undefined {
36+function resolvePackageJsonPath(
37+record: InstalledPluginIndexRecord,
38+realpathCache: Map<string, string>,
39+): string | undefined {
3740if (!record.packageJson?.path) {
3841return undefined;
3942}
4043const rootDir = resolveInstalledPluginRootDir(record);
41-const realRootDir = safeRealpathSync(rootDir) ?? path.resolve(rootDir);
44+const realRootDir = safeRealpathSync(rootDir, realpathCache) ?? path.resolve(rootDir);
4245const packageJsonPath = path.resolve(realRootDir, record.packageJson.path);
4346const relative = path.relative(realRootDir, packageJsonPath);
4447if (!isRelativePathInsideOrEqual(relative)) {
4548return undefined;
4649}
47-if (!isPathInsideWithRealpath(realRootDir, packageJsonPath)) {
50+const packageJsonRealPath = safeRealpathSync(packageJsonPath, realpathCache);
51+if (!packageJsonRealPath || !isPathInside(realRootDir, packageJsonRealPath)) {
4852return undefined;
4953}
5054return packageJsonPath;
@@ -63,6 +67,7 @@ function safeFileSignature(filePath: string | undefined): string | undefined {
6367}
64686569function buildInstalledManifestRegistryIndexKey(index: InstalledPluginIndex) {
70+const realpathCache = new Map<string, string>();
6671return {
6772version: index.version,
6873hostContractVersion: index.hostContractVersion,
@@ -72,7 +77,7 @@ function buildInstalledManifestRegistryIndexKey(index: InstalledPluginIndex) {
7277installRecords: index.installRecords,
7378diagnostics: index.diagnostics,
7479plugins: index.plugins.map((record) => {
75-const packageJsonPath = resolvePackageJsonPath(record);
80+const packageJsonPath = resolvePackageJsonPath(record, realpathCache);
7681return {
7782pluginId: record.pluginId,
7883packageName: record.packageName,
@@ -359,7 +364,10 @@ function normalizePersistedPackageChannel(value: unknown): PluginPackageChannel
359364return channel;
360365}
361366362-function resolveInstalledPackageMetadata(record: InstalledPluginIndexRecord): {
367+function resolveInstalledPackageMetadata(
368+record: InstalledPluginIndexRecord,
369+realpathCache: Map<string, string>,
370+): {
363371packageManifest?: OpenClawPackageManifest;
364372packageDependencies?: PluginDependencySpecMap;
365373packageOptionalDependencies?: PluginDependencySpecMap;
@@ -370,7 +378,9 @@ function resolveInstalledPackageMetadata(record: InstalledPluginIndexRecord): {
370378channel: recordPackageChannel,
371379}
372380 : undefined;
373-const packageJsonPath = record.packageJson?.path ? resolvePackageJsonPath(record) : undefined;
381+const packageJsonPath = record.packageJson?.path
382+ ? resolvePackageJsonPath(record, realpathCache)
383+ : undefined;
374384if (!packageJsonPath) {
375385return fallbackPackageManifest ? { packageManifest: fallbackPackageManifest } : {};
376386}
@@ -409,9 +419,12 @@ function resolveInstalledPackageMetadata(record: InstalledPluginIndexRecord): {
409419return fallbackPackageManifest ? { packageManifest: fallbackPackageManifest } : {};
410420}
411421412-function toPluginCandidate(record: InstalledPluginIndexRecord): PluginCandidate {
422+function toPluginCandidate(
423+record: InstalledPluginIndexRecord,
424+realpathCache: Map<string, string>,
425+): PluginCandidate {
413426const rootDir = resolveInstalledPluginRootDir(record);
414-const packageMetadata = resolveInstalledPackageMetadata(record);
427+const packageMetadata = resolveInstalledPackageMetadata(record, realpathCache);
415428return {
416429idHint: record.pluginId,
417430source: record.source ?? resolveFallbackPluginSource(record),
@@ -452,6 +465,7 @@ export function loadPluginManifestRegistryForInstalledIndex(params: {
452465}
453466const env = params.env ?? process.env;
454467const pluginIdSet = params.pluginIds?.length ? new Set(params.pluginIds) : null;
468+const realpathCache = new Map<string, string>();
455469const diagnostics = pluginIdSet
456470 ? params.index.diagnostics.filter((diagnostic) => {
457471const pluginId = diagnostic.pluginId;
@@ -461,7 +475,7 @@ export function loadPluginManifestRegistryForInstalledIndex(params: {
461475const candidates = params.index.plugins
462476.filter((plugin) => params.includeDisabled || plugin.enabled)
463477.filter((plugin) => !pluginIdSet || pluginIdSet.has(plugin.pluginId))
464-.map(toPluginCandidate);
478+.map((plugin) => toPluginCandidate(plugin, realpathCache));
465479return loadPluginManifestRegistry({
466480config: params.config,
467481workspaceDir: params.workspaceDir,
此内容由惯性聚合(RSS阅读器)自动聚合整理,仅供阅读参考。 原文来自 — 版权归原作者所有。